CVE-2011-1488: Medium severity rsyslog Rsyslog vulnerability
A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled. A local attacker could use this flaw to cause a denial of the rsyslogd daemon service by crashing the service via a sequence of repeated log messages sent within short periods of time.
Other sources
A memory leak was found in the way rsyslog system log deamon processed log messages when the request to reduce the repeated messages ($RepeatedMsgReduction configuration directive) was enabled. A local attacker could use this flaw to cause denial of the rsyslogd daemon service (excessive memory use and potential abort) via sequence of repeated log messages, sent within short time period.
References: [1] http://bugzilla.adiscon.com/showbug.cgi?id=225 [2] http://www.openwall.com/lists/oss-security/2011/03/29/3 [3] http://www.openwall.com/lists/oss-security/2011/04/04/41
Upstream patches: [4] http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=dfa88369d4ca4290db56b843f9eabdae1bfe0fd5 [5] http://git.adiscon.com/?p=rsyslog.git;a=commitdiff;h=8083bd1433449fd2b1b79bf759f782e0f64c0cd2
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1488?
CVE-2011-1488 is considered a medium severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2011-1488?
To fix CVE-2011-1488, upgrade rsyslog to version 5.7.6 or later.
What systems are affected by CVE-2011-1488?
CVE-2011-1488 affects rsyslog versions prior to 5.7.6 on multiple systems, including Debian and openSUSE.
Can CVE-2011-1488 be exploited remotely?
CVE-2011-1488 is primarily a local attack vector, as it requires a local attacker to send repeated log messages.
What symptoms indicate an exploitation of CVE-2011-1488?
Symptoms of CVE-2011-1488 exploitation include unexpected crashes or unresponsiveness of the rsyslogd daemon.